Parse CycloneDX SBOMs to URL or Package, as appropriate.

[mchernicoff]

Currently we parse all CycloneDX SBOMs to a repo URL, regardless of the SBOM's component pURL type. But this is actually doing two steps at once: parsing the target from the pURL and then resolving the target to a git repo URL. Instead, we should treat the pURL like a pURL given as a target, returning a GitHub repo URL, Maven POM file URL, or NPM or PyPI package as appropriate.

Edit: Currently an NPM or PyPI package passed from a CyclconeDX SBOM requires a --ref flag because we do not keep the version information. This fix would make that flag optional when the version is provided in the SBOM's pURL.